{"id":44276,"date":"2021-12-03T13:20:00","date_gmt":"2021-12-03T13:20:00","guid":{"rendered":"http:\/\/d90830de-f5b8-424f-bd09-ecc11b4eaaaf"},"modified":"2021-12-03T13:20:00","modified_gmt":"2021-12-03T13:20:00","slug":"crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/","title":{"rendered":"Crooks are selling access to hacked networks. Ransomware gangs are their biggest customers"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/www.zdnet.com\/a\/img\/resize\/26777d00af07689d20b96d09b0ffdae4e6fa83ae\/2021\/01\/08\/6604d540-9eb0-41c2-9f00-6fbf24d996f7\/hacker-hands-on-a-keyboard.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\" class=\"ff-og-image-inserted\"><\/div>\n<p>There&#8217;s been a surge in cyber criminals selling access to compromised corporate networks as hackers look to cash in on the demand for vulnerable networks from gangs looking to initiate&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/ransomware-an-executive-guide-to-one-of-the-biggest-menaces-on-the-web\/\" target=\"_blank\" rel=\"noopener\">ransomware attacks<\/a>.&nbsp;<\/p>\n<p><a href=\"https:\/\/www.group-ib.com\/resources\/threat-research\/2021-reports.html\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">Researchers at cybersecurity company Group-IB<\/a>&nbsp;analysed activity on underground forums and said there&#8217;s been a sharp increase in the number of offers to sell access to compromised corporate networks, with the number of posts offering access tripling between 2020 and 2021.&nbsp;<\/p>\n<p>Crooks are claiming to offer access to compromised&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/many-organisations-dont-know-how-to-manage-vpn-security-properly-and-cyber-criminals-are-taking-advantage\/\" target=\"_blank\" rel=\"noopener\">Virtual Private Network<\/a>&nbsp;(VPN) and&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/big-jump-in-rdp-attacks-as-hackers-target-staff-working-from-home\/\" target=\"_blank\" rel=\"noopener\">Remote Desktop Protocol<\/a>&nbsp;(RDP) login credentials, as well as web shells, reverse shells,&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/this-is-how-the-cobalt-strike-penetration-testing-tool-is-being-abused-by-cybercriminals\/\" target=\"_blank\" rel=\"noopener\">Cobalt Strike penetration testing tools<\/a>&nbsp;and more.&nbsp;<\/p>\n<p>With this access, cyber criminals can access a company&#8217;s networks and attempt to gain access to usernames and passwords or administrator rights which allow them to gain further control over the network. &nbsp;<\/p>\n<p>On the underground forums being analysed, the number of offers to sell access to corporate networks went up from 362 to 1,099, a rise of three times in just a year and the report warns that increase is &#8220;one of the clearest trends on underground forums&#8221;.&nbsp;<\/p>\n<p>Some of the most common industries to which access is being offered to include manufacturing, education, financial services and healthcare. &nbsp;<\/p>\n<p>The cost of access varies greatly and can sometimes be offered for a few thousand dollars \u2013&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/have-we-reached-peak-ransomware-how-the-internets-biggest-security-problem-has-grown-and-what-happens-next\/\" target=\"_blank\" rel=\"noopener\">something a ransomware crew could make back many times over from a successful attack<\/a>. But there&#8217;s a direct correlation between access value and the victim&#8217;s company revenue \u2013 the higher the revenue, the higher the price. &nbsp;<\/p>\n<section class=\"sharethrough-top placeholder\"> <\/section>\n<p><strong>SEE:&nbsp;<\/strong><a href=\"http:\/\/www.zdnet.com\/topic\/a-winning-strategy-for-cybersecurity\/\" target=\"_blank\" rel=\"noopener\"><strong>A winning strategy for cybersecurity<\/strong><\/a><strong>&nbsp;(ZDNet special report) &nbsp;<\/strong><\/p>\n<p>One of the key reasons there&#8217;s been an increase in sellers is because there&#8217;s the demand which is being driven by&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/ransomware-its-a-golden-era-for-cyber-criminals-and-it-could-get-worse-before-it-gets-better\/\" target=\"_blank\" rel=\"noopener\">the growth in ransomware attacks<\/a>. Ransomware groups need access to networks and <a href=\"https:\/\/www.zdnet.com\/article\/these-hackers-sell-network-logins-to-the-highest-bidder-and-ransomware-gangs-are-buying\/\" target=\"_blank\" rel=\"noopener\">buying access <\/a>is easier and less time consuming than compromising networks themselves.&nbsp;<\/p>\n<p>&#8220;Ransomware operators are the main &#8220;customers&#8221; of initial access brokers&#8217; (IAB) services,&#8221; Dmitry Shestakov, head of cybercrime research at Group-IB told ZDNet.&nbsp;<\/p>\n<p>&#8220;This unholy alliance of IABs and ransomware operators as part of ransomware-as-as-a-service affiliate programs has led to the rise of the ransomware empire,&#8221; he added.&nbsp;<\/p>\n<p>Another reason for the growth of initial access markets is because there is a relatively low skills threshold for engaging in this sort of cyber crime. These less sophisticated cyber criminals can use&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/what-is-phishing-how-to-protect-yourself-from-scam-emails-and-more\/\" target=\"_blank\" rel=\"noopener\">phishing attacks<\/a>&nbsp;or buy off-the-shelf&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/what-is-malware-everything-you-need-to-know-about-viruses-trojans-and-malicious-software\/\" target=\"_blank\" rel=\"noopener\">malware<\/a>&nbsp;to steal information.<\/p>\n<p>The report also suggests that gaining this initial access has got easier due to the rise in remote working as a result of&nbsp;<a href=\"https:\/\/www.zdnet.com\/topic\/coronavirus-business-and-technology-in-a-pandemic\/\" target=\"_blank\" rel=\"noopener\">the&nbsp; pandemic<\/a>, which has resulted in many organisations&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/hybrid-cloud-brings-benefits-but-also-additional-cybersecurity-risks-heres-how-to-securely-manage-your-cloud\/\" target=\"_blank\" rel=\"noopener\">unintentionally using insecure or misconfigured applications<\/a>&nbsp;which cyber criminals can easily exploit.&nbsp;<\/p>\n<p>And as long as there are insecure networks which can be accessed and a demand from other cyber criminals to buy access to those networks, the rise of the access broker market looks set to continue.<\/p>\n<p>&#8220;We expect the number of brokers and initial access offers to grow. As the supply increases to meet the demand, we expect the price of initial access to corporate networks to decrease,&#8221; said Shestakov. &#8220;Ransomware will remain the main way to monetize access to corporate networks because it provides the highest possible return on investment for IABs,&#8221; he added.&nbsp;<\/p>\n<p>There are measures which organisations can take to help avoid cyber criminals breaching the network and gaining access to credentials. &nbsp;<\/p>\n<p>They include&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/this-one-change-could-protect-your-systems-from-attack-so-why-dont-more-companies-do-it\/\" target=\"_blank\" rel=\"noopener\">installing software updates and security patches on a regular and timely basis<\/a>&nbsp;to protect against known vulnerabilities, encouraging the use of&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/want-a-strong-password-youre-probably-still-doing-it-the-wrong-way\/\" target=\"_blank\" rel=\"noopener\">strong passwords<\/a>&nbsp;which are difficult to breach in brute force attacks and applying&nbsp;<a href=\"https:\/\/www.zdnet.com\/article\/multi-factor-authentication-use-it-for-all-the-people-that-access-your-network-all-the-time\/\" target=\"_blank\" rel=\"noopener\">multi-factor authentication<\/a>&nbsp;to accounts so that if credentials are compromised, there&#8217;s limited opportunities for attackers to exploit them.&nbsp;<\/p>\n<p><strong>MORE ON CYBERSECURITY<\/strong><\/p>\n<p> READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/theres-been-a-big-jump-in-crooks-selling-access-to-hacked-networks-ransomware-gangs-are-their-best-customers\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Dark web forum posts offering compromised VPN, RDP credentials and other ways into networks have tripled in the last year.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-44276","post","type-post","status-publish","format-standard","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Crooks are selling access to hacked networks. Ransomware gangs are their biggest customers 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Crooks are selling access to hacked networks. Ransomware gangs are their biggest customers 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2021-12-03T13:20:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.zdnet.com\/a\/img\/resize\/26777d00af07689d20b96d09b0ffdae4e6fa83ae\/2021\/01\/08\/6604d540-9eb0-41c2-9f00-6fbf24d996f7\/hacker-hands-on-a-keyboard.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Crooks are selling access to hacked networks. Ransomware gangs are their biggest customers\",\"datePublished\":\"2021-12-03T13:20:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\\\/\"},\"wordCount\":674,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/26777d00af07689d20b96d09b0ffdae4e6fa83ae\\\/2021\\\/01\\\/08\\\/6604d540-9eb0-41c2-9f00-6fbf24d996f7\\\/hacker-hands-on-a-keyboard.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\\\/\",\"name\":\"Crooks are selling access to hacked networks. Ransomware gangs are their biggest customers 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/26777d00af07689d20b96d09b0ffdae4e6fa83ae\\\/2021\\\/01\\\/08\\\/6604d540-9eb0-41c2-9f00-6fbf24d996f7\\\/hacker-hands-on-a-keyboard.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\",\"datePublished\":\"2021-12-03T13:20:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/26777d00af07689d20b96d09b0ffdae4e6fa83ae\\\/2021\\\/01\\\/08\\\/6604d540-9eb0-41c2-9f00-6fbf24d996f7\\\/hacker-hands-on-a-keyboard.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\",\"contentUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/26777d00af07689d20b96d09b0ffdae4e6fa83ae\\\/2021\\\/01\\\/08\\\/6604d540-9eb0-41c2-9f00-6fbf24d996f7\\\/hacker-hands-on-a-keyboard.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Crooks are selling access to hacked networks. Ransomware gangs are their biggest customers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Crooks are selling access to hacked networks. Ransomware gangs are their biggest customers 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/","og_locale":"en_US","og_type":"article","og_title":"Crooks are selling access to hacked networks. Ransomware gangs are their biggest customers 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2021-12-03T13:20:00+00:00","og_image":[{"url":"https:\/\/www.zdnet.com\/a\/img\/resize\/26777d00af07689d20b96d09b0ffdae4e6fa83ae\/2021\/01\/08\/6604d540-9eb0-41c2-9f00-6fbf24d996f7\/hacker-hands-on-a-keyboard.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Crooks are selling access to hacked networks. Ransomware gangs are their biggest customers","datePublished":"2021-12-03T13:20:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/"},"wordCount":674,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/26777d00af07689d20b96d09b0ffdae4e6fa83ae\/2021\/01\/08\/6604d540-9eb0-41c2-9f00-6fbf24d996f7\/hacker-hands-on-a-keyboard.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/","url":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/","name":"Crooks are selling access to hacked networks. Ransomware gangs are their biggest customers 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/26777d00af07689d20b96d09b0ffdae4e6fa83ae\/2021\/01\/08\/6604d540-9eb0-41c2-9f00-6fbf24d996f7\/hacker-hands-on-a-keyboard.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","datePublished":"2021-12-03T13:20:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/#primaryimage","url":"https:\/\/www.zdnet.com\/a\/img\/resize\/26777d00af07689d20b96d09b0ffdae4e6fa83ae\/2021\/01\/08\/6604d540-9eb0-41c2-9f00-6fbf24d996f7\/hacker-hands-on-a-keyboard.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp","contentUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/26777d00af07689d20b96d09b0ffdae4e6fa83ae\/2021\/01\/08\/6604d540-9eb0-41c2-9f00-6fbf24d996f7\/hacker-hands-on-a-keyboard.jpg?width=770&amp;height=578&amp;fit=crop&amp;auto=webp"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/crooks-are-selling-access-to-hacked-networks-ransomware-gangs-are-their-biggest-customers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Crooks are selling access to hacked networks. Ransomware gangs are their biggest customers"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/44276","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=44276"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/44276\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=44276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=44276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=44276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}